CVE-2023-6181

The vulnerability stems from improper handling of the 'reboot reason' field in the BCB structure, which is a memory area used for communication between the operating system and the bootloader. An attacker can exploit this oversight to inject malicious code that becomes persistent and is executed every time the device starts. This mechanism enables persistent code execution — the code survives system restarts.

An attacker can obtain persistent, unauthorized arbitrary code execution on a Google Chromecast device, potentially leading to complete device takeover, breach of confidentiality, integrity, and data availability.

Apply patches available from the manufacturer according to references — Chromecast security bulletin from December 1, 2023, available at https://source.android.com/docs/security/bulletin/chromecast/2023-12-01. It is recommended to immediately update the firmware of Google Chromecast devices.

Google Chromecast and Google Chromecast Firmware — specific versions indicated in the manufacturer's references (Chromecast security bulletin from 2023-12-01)